From: Luxiao Xu <[email protected]>
When unregistering a trace_uprobe, if the probe has a sibling
(i.e. trace_probe_has_sibling() is true), unregister_trace_uprobe()
jumps directly to unreg, bypassing event busy checks and
unregister_uprobe_event().
However, if the trace_uprobe is currently enabled, freeing it without
disabling it allows uprobe callbacks (such as uprobe_dispatcher()) to
continue accessing the freed trace_uprobe structure. This leads to a
use-after-free (UAF) condition.
Fix this by checking trace_probe_is_enabled() at the entry of
unregister_trace_uprobe(). If the probe is enabled, return -EBUSY
immediately to prevent unregistering and freeing an active probe.
Fixes: 41af3cf587f4 ("tracing/uprobe: Add multi-probe per uprobe event support")
Cc: <[email protected]>
Reported-by: Vega <[email protected]>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Luxiao Xu <[email protected]>
Signed-off-by: Ren Wei <[email protected]>
---
kernel/trace/trace_uprobe.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index c274346853d1..a514a82c4ae0 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -396,6 +396,9 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu)
{
int ret;
+ if (trace_probe_is_enabled(&tu->tp))
+ return -EBUSY;
+
if (trace_probe_has_sibling(&tu->tp))
goto unreg;
--
2.43.0
